rea-agents 4.0.0 → 4.1.0

package/dist/server/registerFirmwareTools.js

@@ -0,0 +1,22 @@
+import { toolContract } from "../contracts/toolContracts.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { toCallToolResult } from "./toolResult.js";
+/** Bind firmware handlers to their exact named schemas. */
+export const registerFirmwareTools = (server, service, logger, recordEvidence) => {
+    const handler = (contract) => async (input, context) => {
+        const result = await logToolExecution(logger, contract.name, () => service.execute(contract.name, input, {
+            signal: context.mcpReq.signal,
+        }));
+        if (!result.ok)
+            return toCallToolResult(result, contract);
+        const recorded = recordEvidence?.(result.value);
+        return recorded !== undefined && !recorded.ok
+            ? toCallToolResult(recorded, contract)
+            : toCallToolResult(result, contract);
+    };
+    const inspect = toolContract("inspect_firmware_regions");
+    server.registerTool(inspect.name, toolRegistrationOptions(inspect), handler(inspect));
+    const extract = toolContract("extract_firmware");
+    server.registerTool(extract.name, toolRegistrationOptions(extract), handler(extract));
+};

package/dist/server/registerFunctionComparisonTool.js

@@ -1,6 +1,6 @@
 import { toolContract } from "../contracts/toolContracts.js";
 import { createEvidence, parseEvidence, } from "../domain/evidence.js";
-import { EvidenceIntegrityError } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import { err } from "../domain/result.js";
 import { compareFunctions } from "../domain/functionComparison.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";

package/dist/server/registerInvestigationTools/helpers.js

@@ -1,4 +1,5 @@
-import { EvidenceIntegrityError, } from "../../domain/errors.js";
+import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
+import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
 import { recordDerivedEvidence } from "../recordDerivedEvidence.js";
 export const isIncomplete = (status) => status === "unknown" || status === "truncated";

package/dist/server/registerManagedTools.js

@@ -1,5 +1,5 @@
 import { MANAGED_TOOL_CONTRACTS } from "../contracts/managedToolContracts.js";
-import { AnalysisInputError } from "../domain/errors.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
 import { err } from "../domain/result.js";
 import { registerEvidenceTools } from "./registerEvidenceTools.js";
 import { runManagedProviderExecution } from "../application/DirectAnalysis.js";

package/dist/server/registerManagedWorkflowTools/evidence.js

@@ -1,5 +1,5 @@
 import { parseEvidence } from "../../domain/evidence.js";
-import { EvidenceIntegrityError } from "../../domain/errors.js";
+import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { err, ok } from "../../domain/result.js";
 const parseExpectedEvidence = (rawEvidence, expectedOperations) => {
     try {

package/dist/server/registerOfficialTools.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { OFFICIAL_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { OFFICIAL_TOOL_CONTRACTS } from "../contracts/officialToolContracts.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonObjectSchema, jsonValueSchema, } from "../domain/jsonValue.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
@@ -66,6 +66,9 @@ const runOfficialOperation = async (analysis, contract, arguments_, execution) =
     return result;
 };
 const projectOfficialArguments = (contract, input) => {
+    // Annotation omissions preserve existing values; they are not Python defaults.
+    if (contract.name === "annotate_native_function")
+        return jsonObjectSchema.parse(contract.inputSchema.parse(input));
     const parsed = jsonObjectSchema.parse(input);
     if (!(contract.inputSchema instanceof z.ZodObject))
         throw new TypeError("Official tool input contract must be an object schema");

package/dist/server/registerProcessComparisonTool.js

@@ -1,5 +1,5 @@
 import { toolContract } from "../contracts/toolContracts.js";
-import { EvidenceIntegrityError } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import { createEvidence, parseEvidence, } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 import { compareProcessCaptures, parseProcessCapture, } from "../domain/processCapture.js";
@@ -81,6 +81,7 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
         return toCallToolResult(recordDerivedEvidence(session, evidence, comparisonUnknownInput({
             left_evidence_id: leftRecord.evidence_id,
             right_evidence_id: rightRecord.evidence_id,
+            comparison_evidence_id: evidence.evidence_id,
         }, comparison)), contract);
     });
 };
@@ -97,8 +98,10 @@ const comparisonUnknownInput = (parsed, comparison) => {
         .filter(([, status]) => status !== "unchanged")
         .map(([scope]) => scope)
         .join(", ");
+    // Unknown identity uses the question, not its supporting records. Bind the
+    // question to this comparison so distinct capture pairs and policies coexist.
     return {
-        question: `Process captures disagree across: ${differingScopes}`,
+        question: `Process captures disagree across: ${differingScopes} (comparison ${parsed.comparison_evidence_id})`,
         severity: "high",
         domain: "process-comparison",
         supporting_evidence_ids: [parsed.left_evidence_id],

package/dist/server/registerSessionTools.js

@@ -4,7 +4,8 @@ import { readAnalysisSnapshot } from "../application/AnalysisSnapshotFiles.js";
 import { createProcessCaptureEvidence } from "../application/ProcessEvidence.js";
 import { captureProcessScenario } from "../application/ProcessHarness.js";
 import { toolContract } from "../contracts/toolContracts.js";
-import { UnknownRegistryError } from "../domain/errors.js";
+import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
+import {} from "../domain/analysisErrorBase.js";
 import { ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 import { registerArtifactComparisonTool } from "./registerArtifactComparisonTool.js";
@@ -98,6 +99,7 @@ const registerOpenLifecycleTool = ({ server, session, logger, openContract, }) =
         }
         const opened = await logToolExecution(logger, openContract.name, () => session.open(input.path, {
             signal: context.mcpReq.signal,
+            ...(input.format === undefined ? {} : { formatHint: input.format }),
             ...(input.provider_id === undefined
                 ? {}
                 : { providerId: input.provider_id }),

package/dist/server/runDerivedOperation.js

@@ -1,5 +1,5 @@
 import { setImmediate } from "node:timers/promises";
-import { AnalysisCancelledError, AnalysisInputError, } from "../domain/errors.js";
+import { AnalysisCancelledError, AnalysisInputError, } from "../domain/analysisErrorCore.js";
 import { err, ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 /** Run synchronous derived work with transport yields and a publication guard. */

package/dist/server/sessionAvailabilityPolicy.js

@@ -3,6 +3,9 @@ import { platform } from "node:process";
 export const sessionAvailabilityPolicy = (configured, defaults) => configured ??
     (() => ({
         processCaptureEnabled: platform !== "win32",
+        firmwareInspectionEnabled: defaults.optionalFeatures?.firmwareInspectionEnabled ?? false,
+        firmwareExtractionEnabled: defaults.optionalFeatures?.firmwareExtractionEnabled ?? false,
+        androidAnalysisEnabled: defaults.optionalFeatures?.androidAnalysisEnabled ?? false,
         browserObservationEnabled: defaults.optionalFeatures?.browserObservationEnabled ?? false,
         browserScenarioEnabled: defaults.optionalFeatures?.browserScenarioEnabled ?? false,
         electronObservationEnabled: defaults.optionalFeatures?.electronObservationEnabled ?? false,

package/dist/server/sessionEvidence.js

@@ -1,4 +1,4 @@
-import { EvidenceIntegrityError } from "../domain/errors.js";
+import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
 import { ok } from "../domain/result.js";
 /** Record source evidence in order, stopping at the first session rejection. */
 export const recordSessionEvidenceSources = (recordEvidence, sources) => {

package/dist/server/toolResult.js

@@ -1,4 +1,5 @@
-import { projectAnalysisError } from "../domain/errors.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import {} from "../domain/analysisErrorBase.js";
 /**
  * Serialize an application result as MCP text and structured content.
  * Shared error projection preserves actionable local diagnostics while omitting

package/dist/windows/WindowsNativeLoader.js

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { PACKAGE_METADATA } from "../generatedPackageMetadata.js";
+/** A native resource remains opaque until the addon validates its object tag. */
+export const windowsHandleSchema = z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value));
+/** Observed identity of an opened local NTFS object. */
+export const windowsFileIdentitySchema = z.strictObject({
+    requestedPath: z.string(),
+    finalPath: z.string(),
+    filesystem: z.literal("NTFS"),
+    volumeSerial: z.string().regex(/^[a-f0-9]{16}$/u),
+    fileId: z.string().regex(/^[a-f0-9]{32}$/u),
+    size: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+    directory: z.boolean(),
+});
+/** Metadata bound to one packaged Windows x64 Node-API artifact. */
+export const windowsNativeManifestSchema = z.strictObject({
+    packageVersion: z.string(),
+    platform: z.literal("win32"),
+    architecture: z.literal("x64"),
+    abiVersion: z.literal(1),
+    nodeApiVersion: z.literal(8),
+    artifact: z.literal("rea-windows-x64.node"),
+    artifactSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+});
+const inspectionSchema = z.strictObject({
+    abiVersion: z.literal(1),
+    nodeApiVersion: z.literal(8),
+    architecture: z.literal("x64"),
+    filesystem: windowsFileIdentitySchema,
+    privateDacl: z.literal(true),
+    atomicJobAssignment: z.literal(true),
+    killOnOwnerClose: z.literal(true),
+});
+const bindingSchema = z.strictObject({
+    call: z.custom((value) => typeof value === "function"),
+});
+/** Validate compatibility and artifact identity before invoking the native addon. */
+export const loadWindowsNativeAuthority = (host) => {
+    if (host.platform !== "win32" || host.architecture !== "x64")
+        return {
+            available: false,
+            reason: "REA Windows native controls require a Windows x64 host.",
+        };
+    try {
+        const manifest = windowsNativeManifestSchema.parse(host.readManifest());
+        if (manifest.packageVersion !== host.packageVersion)
+            throw new Error("Windows native artifact belongs to another REA version");
+        const nodeApiVersion = Number(host.nodeApiVersion);
+        if (!Number.isSafeInteger(nodeApiVersion) || nodeApiVersion < 8)
+            throw new Error("Windows native artifact requires Node-API 8 or newer");
+        const artifact = host.readArtifact();
+        if (createHash("sha256").update(artifact).digest("hex") !==
+            manifest.artifactSha256)
+            throw new Error("Windows native artifact SHA-256 does not match package metadata");
+        assertWindowsX64Artifact(artifact);
+        const binding = bindingSchema.parse(host.loadArtifact());
+        const inspection = inspectionSchema.parse(binding.call("inspect", []));
+        return { available: true, authority: { call: binding.call, inspection } };
+    }
+    catch (cause) {
+        return {
+            available: false,
+            reason: `REA Windows native controls are unavailable: ${cause instanceof Error ? cause.message : String(cause)}`,
+        };
+    }
+};
+const assertWindowsX64Artifact = (bytes) => {
+    if (bytes.length < 64 || bytes.toString("ascii", 0, 2) !== "MZ")
+        throw new Error("Windows native artifact is not a PE image");
+    const offset = bytes.readUInt32LE(0x3c);
+    if (offset > bytes.length - 26 ||
+        bytes.toString("ascii", offset, offset + 4) !== "PE\0\0" ||
+        bytes.readUInt16LE(offset + 4) !== 0x8664 ||
+        bytes.readUInt16LE(offset + 24) !== 0x20b)
+        throw new Error("Windows native artifact is not a Windows x64 PE32+ image");
+};
+let cached;
+/** Load only the package-owned artifact, lazily and once per process. */
+export const systemWindowsNativeAuthority = () => {
+    cached ??= loadWindowsNativeAuthority({
+        platform: process.platform,
+        architecture: process.arch,
+        nodeApiVersion: process.versions.napi,
+        packageVersion: PACKAGE_METADATA.version,
+        readManifest: () => {
+            const encoded = readFileSync(new URL("../../native/windows/build/manifest.json", import.meta.url), "utf8");
+            const value = JSON.parse(encoded);
+            return value;
+        },
+        readArtifact: () => readFileSync(new URL("../../native/windows/build/rea-windows-x64.node", import.meta.url)),
+        loadArtifact: () => {
+            const value = createRequire(import.meta.url)(fileURLToPath(new URL("../../native/windows/build/rea-windows-x64.node", import.meta.url)));
+            return value;
+        },
+    });
+    return cached;
+};
+/** Require the verified backend when an operation depends on native authority. */
+export const requireWindowsNativeAuthority = () => {
+    const loaded = systemWindowsNativeAuthority();
+    if (!loaded.available)
+        throw new Error(loaded.reason);
+    return loaded.authority;
+};

package/dist/windows/WindowsOwnedProcess.js

@@ -0,0 +1,168 @@
+import { EventEmitter } from "node:events";
+import { PassThrough } from "node:stream";
+import { z } from "zod";
+import { requireWindowsNativeAuthority, windowsHandleSchema, } from "./WindowsNativeLoader.js";
+const launchSchema = z.strictObject({
+    pid: z.number().int().positive().max(0xffff_ffff),
+    handle: windowsHandleSchema,
+    jobAssigned: z.literal(true),
+    killOnOwnerClose: z.literal(true),
+});
+const pollSchema = z.strictObject({
+    stdout: z.instanceof(Buffer),
+    stderr: z.instanceof(Buffer),
+    stdoutEnded: z.boolean(),
+    stderrEnded: z.boolean(),
+    exitCode: z.number().int().nonnegative().max(0xffff_ffff).nullable(),
+    activeProcesses: z.number().int().nonnegative(),
+});
+/** Encode one ordinary Windows argv token using the CRT backslash rules. */
+export const quoteWindowsProcessArgument = (value) => {
+    if (value.includes("\0"))
+        throw new TypeError("Windows process argument contains NUL");
+    return `"${value.replace(/(\\*)"/gu, '$1$1\\"').replace(/(\\+)$/u, "$1$1")}"`;
+};
+/** Process events and streams backed by a retained native Job Object. */
+export class WindowsOwnedProcess extends EventEmitter {
+    stdout = new PassThrough();
+    stderr = new PassThrough();
+    signalCode = null;
+    exitCode = null;
+    pid;
+    #handle;
+    #authority;
+    #settled;
+    #settle;
+    #closed = false;
+    #verifiedSettlement = false;
+    #failure;
+    #timer;
+    #cleanup;
+    constructor(command, arguments_, cwd, environment, verbatim) {
+        super();
+        this.#authority = requireWindowsNativeAuthority();
+        const entries = Object.entries(environment)
+            .filter((entry) => entry[1] !== undefined)
+            .map(([key, value]) => `${key}=${value}`);
+        const line = [
+            quoteWindowsProcessArgument(command),
+            ...arguments_.map((value) => verbatim ? value : quoteWindowsProcessArgument(value)),
+        ].join(" ");
+        const launched = launchSchema.parse(this.#authority.call("process_spawn", [
+            command,
+            line,
+            cwd ?? "",
+            entries,
+        ]));
+        this.pid = launched.pid;
+        this.#handle = launched.handle;
+        this.#settled = new Promise((resolve) => {
+            this.#settle = resolve;
+        });
+        this.#schedule();
+    }
+    /** Terminate the retained job, never a PID supplied by another caller. */
+    kill(signal) {
+        if (signal === 0)
+            return (!this.#closed &&
+                z
+                    .number()
+                    .parse(this.#authority.call("process_alive", [this.#handle])) > 0);
+        return this.#closed
+            ? false
+            : z
+                .boolean()
+                .parse(this.#authority.call("process_terminate", [this.#handle]));
+    }
+    /** Terminate and verify that the entire job has settled before releasing it. */
+    cleanup() {
+        this.#cleanup ??= this.#stop();
+        return this.#cleanup;
+    }
+    async #stop() {
+        if (this.#closed)
+            return this.#verifiedSettlement
+                ? { cleaned: true, signaled: false }
+                : {
+                    cleaned: false,
+                    reason: this.#failure ?? "Windows Job Object settlement was not verified",
+                };
+        let timer;
+        try {
+            const signaled = this.kill();
+            const settled = await Promise.race([
+                this.#settled.then(() => true),
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(false), 5_000);
+                }),
+            ]);
+            return settled && this.#verifiedSettlement
+                ? { cleaned: true, signaled }
+                : {
+                    cleaned: false,
+                    reason: this.#failure ??
+                        "Windows Job Object did not settle within the cleanup deadline",
+                };
+        }
+        catch (cause) {
+            return {
+                cleaned: false,
+                reason: cause instanceof Error ? cause.message : String(cause),
+            };
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            if (!this.#closed)
+                this.#release();
+        }
+    }
+    #schedule() {
+        this.#timer = setTimeout(() => this.#poll(), 25);
+    }
+    #poll() {
+        if (this.#closed)
+            return;
+        try {
+            const state = pollSchema.parse(this.#authority.call("process_poll", [this.#handle]));
+            if (state.stdout.length > 0)
+                this.stdout.write(state.stdout);
+            if (state.stderr.length > 0)
+                this.stderr.write(state.stderr);
+            if (state.exitCode !== null && this.exitCode === null) {
+                this.exitCode = state.exitCode;
+                this.emit("exit", state.exitCode, null);
+            }
+            if (state.exitCode !== null &&
+                state.stdoutEnded &&
+                state.stderrEnded &&
+                state.activeProcesses === 0) {
+                this.#verifiedSettlement = true;
+                this.#release();
+            }
+            else
+                this.#schedule();
+        }
+        catch (cause) {
+            const failure = cause instanceof Error ? cause : new Error(String(cause));
+            this.#failure = failure.message;
+            // Native lifecycle failures belong to the error/cleanup channels, never
+            // the captured stderr observation produced by the child itself.
+            if (this.listenerCount("error") > 0)
+                this.emit("error", failure);
+            this.#release();
+        }
+    }
+    #release() {
+        if (this.#closed)
+            return;
+        if (this.#timer !== undefined)
+            clearTimeout(this.#timer);
+        this.#authority.call("process_close", [this.#handle]);
+        this.#closed = true;
+        this.stdout.end();
+        this.stderr.end();
+        this.#settle?.();
+        this.emit("close", this.exitCode, null);
+    }
+}

package/dist/windows/WindowsPrivateRuntime.js

@@ -0,0 +1,137 @@
+import { win32 } from "node:path";
+import { z } from "zod";
+import { requireWindowsNativeAuthority, windowsFileIdentitySchema, windowsHandleSchema, } from "./WindowsNativeLoader.js";
+const runtimeSchema = windowsFileIdentitySchema.extend({
+    path: z.string(),
+    handle: windowsHandleSchema,
+    privateDacl: z.literal(true),
+});
+const snapshotSchema = z.strictObject({
+    sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    source: windowsFileIdentitySchema,
+    snapshot: windowsFileIdentitySchema,
+});
+const fileSchema = windowsFileIdentitySchema.extend({
+    handle: windowsHandleSchema,
+});
+const runtimes = new Map();
+/** Retain private DACL and path handles until native recursive cleanup settles. */
+export class WindowsPrivateRuntime {
+    observation;
+    authority;
+    // One native snapshot can own cancellation for this runtime at a time. A
+    // second request throws ERROR_BUSY before #pending or its abort listener is
+    // replaced, so aborting a rejected request cannot cancel the accepted copy.
+    #pending;
+    #closed = false;
+    #closePromise;
+    constructor(observation, authority) {
+        this.observation = observation;
+        this.authority = authority;
+    }
+    /** Create a new directory with its private DACL installed at creation. */
+    static create(parent, prefix) {
+        const authority = requireWindowsNativeAuthority();
+        const observation = runtimeSchema.parse(authority.call("runtime_create", [parent, prefix]));
+        const runtime = new WindowsPrivateRuntime(observation, authority);
+        runtimes.set(observation.path.toLowerCase(), runtime);
+        return runtime;
+    }
+    /** Open a private child directory through retained, verified parent handles. */
+    mkdir(relativePath) {
+        this.authority.call("runtime_mkdir", [
+            this.observation.handle,
+            relativePath,
+        ]);
+    }
+    /** Write a new private file once and retain its immutable handle. */
+    writeFile(relativePath, content) {
+        this.authority.call("runtime_write", [
+            this.observation.handle,
+            relativePath,
+            Buffer.from(content),
+        ]);
+    }
+    /** Copy admitted source bytes and digest the bytes actually written. */
+    async snapshot(sourcePath, relativePath, signal) {
+        // Admission is synchronous; record ownership only after native acceptance.
+        const pending = Promise.resolve(this.authority.call("runtime_snapshot", [
+            this.observation.handle,
+            sourcePath,
+            relativePath,
+        ]));
+        this.#pending = pending;
+        const cancel = () => {
+            this.authority.call("runtime_snapshot_cancel", [this.observation.handle]);
+        };
+        signal?.addEventListener("abort", cancel, { once: true });
+        if (signal?.aborted === true)
+            cancel();
+        try {
+            return snapshotSchema.parse(await pending);
+        }
+        finally {
+            signal?.removeEventListener("abort", cancel);
+            if (this.#pending === pending)
+                this.#pending = undefined;
+        }
+    }
+    /** Read a private endpoint from an opened file, without re-opening its path. */
+    readFile(relativePath) {
+        const file = fileSchema.parse(this.authority.call("runtime_open", [
+            this.observation.handle,
+            relativePath,
+        ]));
+        try {
+            const chunks = [];
+            for (let offset = 0; offset < file.size;) {
+                const value = z
+                    .instanceof(Buffer)
+                    .parse(this.authority.call("read", [
+                    file.handle,
+                    offset,
+                    Math.min(65_536, file.size - offset),
+                ]));
+                if (value.length === 0)
+                    throw new Error("Private runtime file ended before its observed size");
+                offset += value.length;
+                chunks.push(value);
+            }
+            return Buffer.concat(chunks).toString("utf8");
+        }
+        finally {
+            this.authority.call("close", [file.handle]);
+        }
+    }
+    /** Remove owned objects by handle, unlinking reparse entries without traversal. */
+    close() {
+        this.#closePromise ??= this.#remove();
+        return this.#closePromise;
+    }
+    async #remove() {
+        if (this.#closed)
+            return;
+        if (this.#pending !== undefined)
+            this.authority.call("runtime_snapshot_cancel", [this.observation.handle]);
+        await this.#pending?.catch(() => undefined);
+        try {
+            this.authority.call("runtime_close", [this.observation.handle]);
+        }
+        finally {
+            this.#closed = true;
+            runtimes.delete(this.observation.path.toLowerCase());
+        }
+    }
+}
+/** Select an already-owned runtime; an arbitrary pathname cannot grant authority. */
+export const windowsPrivateRuntime = (rootPath) => {
+    const runtime = runtimes.get(rootPath.toLowerCase());
+    if (runtime === undefined)
+        throw new Error(`No native private runtime owns ${rootPath}`);
+    return runtime;
+};
+/** Read a runtime endpoint using the lease that owns its parent directory. */
+export const readWindowsPrivateRuntimeFile = (path) => {
+    const parent = win32.dirname(path);
+    return windowsPrivateRuntime(parent).readFile(win32.basename(path));
+};

package/install.sh

@@ -55,17 +55,15 @@ fi
 platform="$(uname -s)"
 [[ "$platform" == "Darwin" || "$platform" == "Linux" ]] || fail "REA supports macOS and selected 64-bit Linux distributions."
 command -v curl >/dev/null 2>&1 || fail "curl is required. Install curl, then rerun this installer."
-command -v node >/dev/null 2>&1 || fail "Node.js 22.19+ or 24.11+ is required; install it from https://nodejs.org and retry."
+command -v node >/dev/null 2>&1 || fail "Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+ is required; install it from https://nodejs.org and retry."
 command -v npm >/dev/null 2>&1 || fail "npm is required; install it with Node.js and retry."
 
 node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
 IFS=. read -r node_major node_minor _node_patch <<<"$node_version"
 [[ "$node_major" =~ ^[0-9]+$ && "$node_minor" =~ ^[0-9]+$ ]] || fail "the active Node.js version could not be read. Check that node works and is on PATH, then retry."
-if ! ((node_major == 22 && node_minor >= 19 || node_major >= 24)); then
-  fail "Node.js $node_version is unsupported; use Node.js 22.19+ or 24.11+."
-fi
-if ((node_major == 24 && node_minor < 11)); then
-  fail "Node.js $node_version is unsupported; use Node.js 24.11 or newer."
+if ! [[ "$_node_patch" =~ ^[0-9]+(\+[0-9A-Za-z.-]+)?$ ]] ||
+  ! ((node_major == 22 && node_minor >= 19 || node_major == 24 && node_minor >= 11 || node_major >= 26)); then
+  fail "Node.js $node_version is unsupported; use Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+."
 fi
 
 if [[ -n "$version" ]]; then